Brazil’s Illegal Betting Payment Blocks: The New Rules Explained

Brazil has expanded its enforcement against unauthorised fixed-odds betting from websites to the payment system. Ordinance SPA/MF No. 2,750/2026 requires financial institutions, payment institutions and payment-arrangement operators to monitor suspected illegal betting flows, report qualifying evidence and act on blocking notices issued by the Secretariat of Prizes and Betting (SPA). The measure took effect when it was published in the Official Gazette on 14 September 2026.

The ordinance prohibits covered institutions from allowing transactions intended for fixed-odds betting with people or companies that lack the federal authorisation required by Brazilian law. It creates a structured process rather than treating every unusual transfer as proof of illegal gambling.

Banks and payment providers must first monitor, select and analyse transactions for indicators of unauthorised betting. If that analysis identifies relevant signs, the institution must report them to the SPA. The regulator then determines whether an operator is irregular and, where appropriate, issues a formal finding and blocking notice identifying the operator, domains, accounts and supporting evidence.

Three deadlines define the operational response. An institution’s selection and analysis of a suspicious situation may take no more than 45 days. If the completed analysis finds indicators of illegal betting or an attempt to evade restrictions, the report to the SPA is due by the next business day.

After an SPA blocking notice arrives, a bank or payment institution has up to 24 hours to block accounts held by the identified illegal operator and prevent funds from moving. Covered institutions must also establish a block on new transactions that would directly or indirectly support that operator within 24 hours. Confirmation to the SPA is due within 48 hours of the relevant action.

These clocks do not mean that every customer transfer containing a gambling-related word must be frozen immediately. The 45-day period concerns institutional analysis of suspicious activity; the 24-hour duties begin after the SPA has made a formal finding and sent a blocking notice.

The ordinance lists examples that institutions should assess together and in proportion to risk. They include frequent small or medium transfers from multiple senders, sudden increases in transaction volume, activity inconsistent with the recipient’s declared business and repeated replacement of Pix keys, QR codes, payment links or recipient accounts after restrictions.

Other indicators include gambling-related references in payment fields, newly formed companies receiving unusually large numbers of transfers, funds concentrated through intermediary accounts and money rapidly dispersed to third parties or converted into virtual assets. No single example is automatically conclusive. The institution must examine the wider pattern and record why it did or did not identify a possible illegal betting link.

Unauthorised operators may try to avoid direct identification by collecting deposits through another person, a payment gateway, a facilitator or a changing set of recipient accounts. The ordinance therefore extends monitoring and reporting to suspected intermediary accounts, even where the account holder is not the operator named on the betting site.

It also directs institutions to look for attempts to restart payment activity after a block through new companies, natural persons, accounts or payment credentials. This matters because blocking a domain alone does not remove an operator’s ability to receive money if its payment route can quickly move elsewhere.

The institution must notify the account holder after the block has been implemented and provide the SPA finding and blocking notice. It must not warn the holder before taking the action. Information about the blocked account and balance is then sent to the SPA, which forwards the case material to the National Secretariat of Public Security for the administrative forfeiture process.

The ordinance expressly preserves the account holder’s right to notice, challenge and a full defence in that process. A block is therefore an enforcement step based on the SPA’s formal finding, while the final treatment of blocked funds follows the separate administrative procedure set by law and regulation.

Brazilian players should verify the exact legal entity, brand and complete domain against the SPA’s current authorised-operator list before depositing. A familiar brand name, sponsored post, functioning Pix option or copied government seal does not establish federal authorisation. The ordinance requires the SPA list to include the authorisation act, company name, CNPJ, brand and authorised domain, with structured download access and an API when the dedicated system supports it.

A failed or redirected payment can indicate that a restriction has been applied, but it is not a complete licence check. Players should not try another account, intermediary, cryptocurrency route or replacement payment link to bypass a block. They should preserve transaction records and use official regulator or consumer channels if money remains with an unauthorised operator.

Federally authorised operators should ensure that the recipient name and payment route shown to customers match the approved legal and commercial structure. Transactions to an unexplained third party can resemble the intermediary patterns that institutions are required to investigate. Operators also need current records for their brands and domains because financial institutions will use the SPA’s official list when assessing activity.

The new framework does not replace anti-money-laundering reporting. The ordinance states that its communications are separate from existing prevention duties relating to money laundering, terrorist financing and proliferation financing. A transaction may therefore engage more than one compliance process, each with its own legal basis and reporting route.

Brazil has already used domain blocking against illegal betting sites. Payment enforcement targets a different dependency: the ability to collect deposits and move proceeds. Its effectiveness will depend on accurate SPA findings, timely cooperation across the financial system and controls that can identify replacement routes without treating ordinary customer activity as proof of wrongdoing.

For players, the practical message is simpler. Use the official authorised list, match the domain exactly and avoid payment instructions that move money to unrelated people or frequently changing accounts. Gambling is restricted to adults aged 18 or older in Brazil, always involves a risk of loss and should never be used as a source of income.

Sources: Brazilian Official Gazette, “Ordinance SPA/MF No. 2,750 of 10 September 2026” (published 14 September 2026, official duties, indicators, deadlines and enforcement process); Brazil Ministry of Finance, “SPA publishes ordinance to combat the illegal betting market” (15 September 2026, official summary and legal context); and SBC News, “Brazil orders direct bank controls to stop illegal gambling flows” (16 September 2026, secondary industry reporting). Requirements and operator status can change; consult the current SPA rules and authorised-operator list before acting.